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ON 

^ I Abstract We define an infinite stochastic state machine, the Battery- 

Discharge-Model (BDM), which simulates the behaviour of linear and jump 
complexity of the continued fraction expansion of multidimensional formal 
power series, a relevant security measure in the cryptanalysis of stream ci- 
O i phers. 

We also obtain finite approximations to the infinite BDM, where polynomially 
^ . many states suffice to approximate with an exponentially small evToi the prob- 

^ ! abilities and averages for linear and jump complexity of M-multisequences 

of length n over the finite field Fg, for any M, n, q. 



^ ' Introduction 
l> ■ 

^ ' In cryptography two important measures of sequence complexity are the 

linear and jump complexity, dealing with the continued fraction expansion 
X ■ of the sequence seen as formal power series over some finite field Fg. While 

■ both complexities are well understood for single sequences ([3],[B]), a current 

topic is to generalize these notions to multisequences (M streams of symbols 
in parallel) with first results for M = 2, g = 2 given in [2]. 

In Section I we suggest an infinite recurrent stochastic automaton and finite 
approximations, the Battery-Discharge-Model that simulates the continued 
fraction expansion (proof in Section II) and thus (Section III) answers ques- 
tions about linear and jump complexity for every M ("multi"-ness), q (order 
of finite field), and n (length of sequence). 



^Supported by FONDECYT 1040975. Partly supported by DID UACh. 
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I. The Battery— Discharge— Model 



In this first part, we develop in three steps an infinite stochastic automaton, 
the Battery-Discharge-Model and a family of finite approximations. 

a) Model without discharge 

We fix a number M e N and then have M batteries, each holding a charge 
6i G Z, 1 < i < M, and a drain G Z, hence an infinite number of possible 
states. The initial state is d = bi = 0. 

The model cyclically runs through M + 1 main cycles T = 0, . . . , M. At 
each transition T — T + 1 for T = 0, . . . , M — 1, the drain is decremented, 
d := d — 1, whereas the batteries do not change. At the transition from 
T = M to T = 0, all batteries are incremented, hi :— hi + 1,1 < i < M, 
whereas d remains constant. With the initial condition d — — 0, we thus 
have 



Writing the state in the form . . . , bM', d)T, we obtain the following be- 
haviour for this model: (0, . . . , 0; 0)o ^ (0, . . . , 0; -l)i ^ (0, . . . , 0; -2)2 ^ 

^ (0, . . . , 0; -M)m (1, . . . , 1; -M)o (1, . . . , 1; -M - l)i ^ 

(1, . . . , 1; -M - 2)2 ^ • • • ^ (1, . . . , 1; -2M)m ^ (2, . . . , 2; -2M)o ^ . . . 

b) Model with discheirge 



Each of the M + 1 major cycles now is divided into M + 1 sub cycles t = 
M. Subcycle * shows the result of decrementing d or incrementing 
the bi, whereas during subcycle t,t = 1, . . . , M, battery bt may discharge into 
the drain, provided it has high enough potential that is bt > d. In this case 
the excess charge goes from bt to the drain, amounting to an interchange 
d 6t of values, thus maintaining the invariant. 

The behaviour with discharge is as follows (for illustration we use M = 3): 
The underlined battery is the one, bt, corresponding to the subcycle. We show 
the result at the end of the subcycle. In case of a discharge, (the new) bt is 
in boldface: 



{bi,b2,b3;d)T,t = (0,0,0; 0)0,* ^ (0,0,0;0)o,i ^ (0,0,0; 0)0,2 ^ (0,0,0; 0)0,3 ^ 
(0,0,0; -1)1,* ^ (^,0,0; 0)1,1 ^ (-1, 0, 0; 0)1,2 ^ (-1, 0,0; 0)1,3 
(-1,0,0; -1)2,* ^ (^,0,0; -1)2,1 ^ (-1,^,0;0)2,2 ^ (-1, -1,0; 0)2,3 ^ 
(-1,-1,0; -1)3,* ^ (^,-1,0; -1)3,1 ^ (-1,^,0; -1)3,2 ^ (-1, -1,^; 0)3,3 



M 




i=l 
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(0, 0, 0; 0)o,* ^ (0, 0, 0; 0)o,i ^ (0, 0, 0; 0)o,2 ^ (0, 0, 0; 0)o,3 ^ ■ • • 
The behaviour of this model Lb) is (purely) periodic. 

c) Model with discharge and inhibition 

Finally we introduce the stochastic element of temporary inhibition of a 
battery (observe that in La) the batteries never discharge, in Lb) always): 

Let ^, with < ^ < 1, be the probability that a battery with bt > d will be 
inhibited and thus will not discharge. We now have a stochastic behaviour: 
(0,0,0;0)o,* ^ ... (0,0,0; -l)i,, with probability 1, but (0, 0, 0; -l)i,, 
(-1, 0, 0; o')i,i with probability and (0, 0, 0; -l)i,* (0, 0, 0; -l)i,i with 

probability -, and then battery 2 may be inhibited or not etc. 



A more involved example: From (0,2, 1; — 4)i ,f within cycle T = 1, six out- 
comes are possible ("D" = discharge, "/" = inhibition, "— " = bi < d): 



(6i,62,&3;c?)i,* 


h 


b2 


h 




Prob 


((i;6i,62,&3)i,3 - 


((i;6i, 62,^3)2,* 


(0,2,1 


-4) 


D 


D 




(q 


- 


(-4, 0,1; 2) - 


- (-4,0,1;1) 


(0,2,1 


-4) 


D 


I 


D 


iq 


(-4,2,0;1) - 


- (-4,2,0;0) 


(0,2,1 


-4) 


D 


I 


I 


{q 


- 1)/?^ 


(-4,2,1;0) - 


(-4,2,1;-1) 


(0,2,1 


-4) 


I 


D 




iq 


(0,-4,1; 2) - 


- (0,-4,l;l) 


(0,2,1 


-4) 


I 


I 


D 


{q 


- l)/q' 
l/g3 


(0,2,-4;l) - 


- (0,2,-4;0) 


(0,2,1 


-4) 


I 


I 


I 




(0,2,1; -4) - 


- (0,2,1; -5) 



For instance, the transition of the second line consists of these steps: 

(0, 2, 1; -4) ""-U (-4, 2, 1; 0) ^ (-4, 2, 1; 0) (-4, 2, 0; 1) (-4, 2, 0; 0)) 



d) Properties of the full mo dei 

This is our full model. We shall use only the states at timesteps (T, *) and let 
the transition probability take care of the events (discharge, inhibition) dur- 
ing subcycles t = 1, . . . , M. The state set is isomorphic to Z*^ x {0, . . . , M}, 
where the M battery levels and the main cycle are given and the drain value 
results implicitly from d = —T — J^fLi ^i- 

Every transition probability is of the form ^^^-^p- for b batteries with 6j > d at 
their subcycle, with a discharges and b — a inhibitions. So, all transition (and 
state) probabilities are polynomial functions in q by construction. The values 

which of course could be called the Butterfly-Dinner-Model, where M flowers fi are 
visited in turn by a butterfly, dining from the supplied nectar, whenever the level exceeds 
that of the butterfly, with probability - that the flower has its petals closed... 
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for bi, d in the successor state (T + 1, *) already incorporate the decrement 
of d or increment of the bi. 

Let Qt be the (infinite) set of all states in main cycle T, T = 0, . . . , M. We 
adjoin a class G Nq to each state as follows: State (0, ... ,0; 0)o,* and all 
states reachable without inhibition from here are in class (these are just 
the states (. . . of model Lb). All states reachable from a class K with 
i G No inhibitions belong to class K + i. If a state can be reached in different 
ways (number of inhibitions), the smallest such class number applies. The 
rationale for these classes is: 

i) Numerical evidence shows that in the stationary distribution of the infinite 
model in each cycle T, every state of class K occurs with probability exactly 

times the probability of the (unique) state in class 0. 

ii) For q oo, almost always we are in the states of class 0. Hence, restricting 
the (infinite) state set Z*^ x {0, . . . , M} to those states within classes . . . Kq, 
for some fixed accuracy Kq G Nq, we obtain - at least for large g - a fairly 
good approximation to the infinite model. In this case, for a state in class K, 
the model allows at most Kq—K more inhibitions and thus the {Kq—K +l)-st 
battery with b > d has to discharge (with probability 1). 

iii) Also, simulation results for Kq up to 120 show that the number of states 
in class K for the unbounded model and for each main cycle T is pk{M), the 
number of partitions of K into at most M parts or - what is the same - into 
parts of size at most M. pk{M) grows as ~ Mi'iM-iy. asymptotically for fixed 
M and K oc (see INRIA [8] and Sloane's [9] integer sequences). Thus the 
bounded finite models have an overall number of states {M+1)-J2k=oPk{M). 
Furthermore, let us define V{M,q) = X^i^eNo ^'^(^) ' ~ '^s^Qt ^'^^'^^ 
(the same for every T). Then a state of class K has probability q~^^ /V{M, q). 

Example The bounded model for M = 3 and Kq = 2 consists of (3 + 1) ■ 
Y^'k=oPk{'^) = 16 states (one state each in class and 1, two states in class 
2, for each T). Since p(3, q) = q^/{{q - lf{q + 1)), already this very limited 
model accounts for a share (1 ■ + 1 ■ + 2 ■ q^) /V{M, q) of the stationary 
probability distribution of the unbounded model, which is 75% for q = 2, 
99.6% for g = 8 etc. 

Here we give all states with class K < Kq = 2, belonging to subcycle (T, *) 
together with all of their successor states in subcycle (T + 1, *) and the 
respective transition probability. In the first line e.g., we have a probability 
of 1/g^ to go to (0,0,— 1;0) instead of (g — l)/g^ (for 2 inhibitions and 1 
discharge), since battery 2 has to discharge to keep within K < Kq, state 
(0, 0, 0; —1) does not appear in this bounded model. 
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(0,0, 0;0) 
(-1,0,0;!) 
(0,-1, 0;1) 
(-1,0, 1;0) 
(-1,0, 0;0) 
(0,-1, 0;0) 
(0,0, -1;0) 
-1,-1,0;1) 
-1,-1,0;0) 
-1,0,-1;0) 
-1,0,0;-1) 
(0,-1, -1;0) 
(-1,-1, -1;0) 
(-1,-1, 0;-l) 
(-1,0,-1;-1) 
(-2,-l,0;0) 



Nextstates : Probability 
-1,0,0;0) : 2^, (0, -1, 0; 0) : 2-^, 
-1,0, 0;0) : 1 
0,-1, 0;0) : 1 
-1,-1,0;1) 
-1,-1,0;0) 
-1,-1,0;0) 
-1,0,-1;0) 
-1,-1,0;0) 



(0,0, -1;0) : ^ 



1 

2-1 

(0 

1 



(-1,0,-1;0) 
(0,-l,-l;0) 
1,-1;0) 



9-1 



-1,0,0;-1) 



-l,-l,-l;0):2-i, 
-l,-l,-l;0):2-i, 

-2,-l,0;0) : 1 
-1,-1,-1;0) : 1 
0,0, 0;0) : 1 
-1,0, 0;1) ■ ' 
-1,0, 0;1) 
-1,0, 0;1) 



(-1,-1,0;-1) 
(-1,0,-1;-1) 



-1,0,1;0) 



'-f, (0,-l,0;l):i 
^, (-l,0,l;0):i 



(0,-l,0;l):i 



II. The BDM and Continued Fraction Expansion 

We now apply the BDM to obtain precise values about the behaviour of the 
linear and jump complexity of multisequences: Let Gt{a) = Xli^i ^ 
Fg[[x~^]], t = 1, . . . , M be M formal power series over the finite field F^. 

The linear complexity of {Gt{a) | 1 < t < M) at n is defined as the smallest 
degree of a polynomial v{x), such that there are some polynomials Ut{x), 1 < 
t < M with Gtix) = ^ + 0(a;-('^+^)). The jump complexity in turn counts, 
how often this smallest degree has changed (increased) until step n (see |1] [5]). 

We derive these complexities from our BDM, using its equivalence to the 
multi-Strict Continued Fraction Algorithm (m-SCFA) of Dai and Feng [2]. 

The m-SCFA uses the following variables to describe the state: 

n, the timestep 

d =: (iscFA; the degree of v, the current approximation denominator 
WtA^t^ M, a "degree deviation" of ut{x) at sequence t 
Our BDM uses the equivalent variables: 
(*) T, timestep, with T = n mod (M + 1) 

(**) d =: dsDM, c^BDM = c^scFA " 5 the deviation of deg{v) from its 

typical value, 
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* * * 



bt, bt = [jTnl — Wt,l < t < M, the battery levels. 



.A/+l_ 

Observe that initially (at n = T = 0) (iscFA = c^bdm = Wt 
both models coincide according to equivalences (*) to (* * *) 



0,Vt, so 



Let us first consider the timestep n, main cycle T, at subcycle *: 
Assuming (iscFA, Wt fix with n — n + 1 we must have the new values 



_,_ (**)! 



SCFA 



(n + 1) ■ M' 

M + 1 



SCFA 



n ■ M 
M + 1 



— e 



where e 



for n 

1 (***)! 



-1 = mod (M + 1) and 1 otherwise, and 
n+1 



M + 1 



Wt 



n 



+ e - Wt = bt + 6,\/t 



_M + 1_ 

where e = 1 for n + 1 = mod (M + 1) and otherwise. This corresponds 
to incrementing the b'^s for T = M — > and otherwise decrementing d. 

Now, within the M subcycles t = 1, . . . , M we consider four cases, according 
to a "discrepancy" 6 of the m-SCFA (the deviation between the formal power 
series and the approximation by Ut{x)/v{x)) and the values of n, d, wf. 



m-SCFA j2i Thm. 2] 

1 6 = and n — c/scfa ^ Wt a 

2 5 7^ and n — d^cFA ^Wt c 

3 5 = and n — (iscFA > Wt a 

4 5 7^ and n — rfscFA > Wt b 



BDM Case 
level too low, "-" 
level too low, "-" 
inhibition "I" 
discharge "D" 



First note that n - dgcFA >Wt^n-[ + c/bdm) > -bt^bt> 

o^BDM corresponds to cases 3 and 4, that is discharge or inhibition. We model 
a discrepancy value 5 = by the probability of inhibition 1/q, according to 
the following proposition about the even distribution of discrepancy values. 

Proposition In any given position (m, n), 1 < m < M, n eN of the formal 
power series, exactly one choice for the next symbol am,n will yield a discre- 
pancy 6 = 0, all other q — 1 symbols from ¥q result in some 6^0. 

Proof: The current approximation ul^''^\x)/v''^''^\x) determines exactly 
one approximating coefficient sequence for the m-th formal power series 
Gm- The (only) corresponding symbol belongs to 5 = 0. □ 

In fact, for every position (m, n), each discrepancy value 5 G Fg occurs exactly 
once for some am,n G ¥q, in other words (compare [1][5] for M = 1): 



Fact The Generalized Berlekamp-Massey-Algorithm (GBMA) and the multi- 
Strict Gontinued Fraction Algorithm (sGFA) induce an isometry on (F^-'^)'^. 

Concerning the update of the c/scfa and Wt values, in cases 1 to 3 nothing 
happens, neither in the m-SCFA, nor in the BDM. In case 4 the updated 
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values in [2] are d^cFA = n — Wt and wf' = n — dscFA, thus our BDM must set: 



"bdm 
and 



(**) 



n 



M + 1 



SCFA" 



-W, 



n ■ M 
M+1 



n-wt)- 



' n- M' 




n 




n 


M+1 




_M + 1_ 


_M+ 1_ 



n 



M + 1 



■{n—d: 



SCFA J 



(**) 



n ■ M 

M + 1 



+'^BDM + 



n ■ M 

M+1 



that is interchange of c^bdm with bt, as takes place in a discharge. 



Finally, our transition probability over all M subcycles of / or - is the 



product 



q-1 



1\*' 



#- 



(where + i^I + j^- = M), cor- 



responding to (g — l^#^l#^q#-' different M-tuples of symbols in row n of 
the M formal power series {i^D times 6^0, 7^/ times S = 0, times any 
symbol from Fg). 



III. Numerical Results about 

Multidimensional Linear and Jump Complexity 

We have an infinite model and finite aproximations that simulate the be- 
haviour of the multidimensional continued fraction expansion algorithm: The 
drain d corresponds to the linear complexity deviation d = deg{v) — 
whereas each "D" in a transition corresponds to a jump by a height ht — d. 

We start at time with a probability distribution of pr(0, . . . , 0; 0) = 1, 
zero everywhere else, and run the state transition matrix until reaching the 
stationary equilibrium. 



a) Linear complexity deviation 



The average linear complexity deviation in level T is {V{M, q) as in I.d): 



d{M,T) = ^'^ff^ — ' = ^^i:,^, . , T = 0,...,M. 



Also, we have (i(M) = ^^^q d{M^ T) / (M + 1) as average over all T. 

d{M) turns out to be zero for all M and q, another argument for our choice 
of deg{v) ~ [;^^] as "typical" behaviour. 

The probability that the degree deviation has a certain value do, for some 
T, is pr{d = do)(M,T) = {j2seQTAs)=do q~^^"^) /'P{M,q) and we set pr{d = 
do)M = Y.T=oP^id = do){M,T)- We have pr{d = do)M = pr{d = -do)M- 



The genera]_ (in q) formula for d{M,T) is d{l,0) = -d{l, q/{q + if, 
d{2,0) = -d{2,2) = {q'' + q^-q^ + q^ + q)/{q'^ + l){q^ + q+iy,d{2,l)_= 0, and 
in general d{M,T) = -d{M, M - T) for < T < M, leading to d{M) = 
(all this by numerical evidence). For g = 2, we obtain 



M 


a!(M, 0) 


d{M, 1) 


d(M 2) 


d{M, 3) 


d{M, 4) 




1 


0.222222 


-0.222222 
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n 










3 


0.352021 


0.10806 


-0.10806 


-0.352021 






4 


0.370890 


0.163309 





-0.163309 


-0.3708 


i90 


5 


0.380275 


0.191638 


0.0572067 


-0.0572067 


-0.191638 


6 


0.384972 


0.206045 


0.0868915 





-0.0868 


;915 


7 


0.387277 


0.213270 


0.1019991 


0.0297877 


-0.0297877 


8 


0.388441 


0.216919 


0.1096532 


0.0450379 







M 


p{d = 0) 


p{d = ±l) 


p{d = ±2) 


p{d = ±3) p{d 


= ±4) 


p{d = ±5 


1 


0.5 


0.1875 


0.046875 


0.011719 0.002930 


0.000732 


2 


0.55 


0.19414 


0.026959 


0.03412 0.000427 


5.34e - 5 


3 


0.61920 


0.176843 


0.012701 


0.0008006 5.0066e - 5 


3.1292e - 



For q = 100 (remember that our model requires only 2 < g G M), the values 
for d{M, T) (and similar for all the other results) suggest formal power series 
in q~^, as such valid for any q (the dots separate the powers of q~^): 

M d{M,0) d{M,l) 
1 0,00.98.02.96.04.94.06.92 
1 0,00.99.97.03.01.94.04.02.86 

3 0,00.99.98.98.03.01.98.92.99 0,00.00.98.99.98.03.00.00.96.9 
For M — 1 and 2 the closed form was already given, for M = 3 we obtain: 
d(3, 0) = Iq-^ + Og-2 - Ig"^ - 2g-^ + Sq'^ + 2q-^ - Ig"^ - 7g-^ ± . . . 
d{3, 1) = Og-i + lg-2 - lg-3 + Og"^ - 2q-^ + 3q-^ + Og"^ + lg-« - 3q-^ ± . . . 



b) Jump complexity 

The jump complexity counts how many discharges occur, and with which 
height bt — d. Let Si — ^ S2 with t E {I, D, — }^ be some transition, where t 
denotes the actions at the M batteries. Let tj, to, t~ be the respective number 

of symbols /, D, and — in t, then t has overall probability _ . , ^ — r- — — — . 

7^(M, g) qti+tD 

Hence, we have an average jump complexity per time unit of 

S1-*S2,Si€Qt ,S2€Qt+1 
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hence up to n an expected average of n ■ J :— n • j^:^ ^t=o '^(^) jumps. 
Also, we calculate how many jumps by height h & N occur on average as: 



JH(h) 



-TT > >^ \U \ bi — d — h in t} \ ■ -ztt-— — r 

Si — > S2 

SI 6 Qt, S2 6 Qt+1 



Again, we list some values and also have a closed formula for M = 1 and 2. 
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M 


J 


JH{1) 


JH{2) 


JH{3) 


JH{4) 


JH{5) 


1 


0.25 


0.125 


0.0625 


0.03125 


0.015625 


0.007813 


2 


0.44444 


0.29167 


0.10417 


0.03385 


0.10417 


0.003092 


3 


0.58929 


0.45786 


0.10699 


0.02023 


0.003456 


0.000549 


4 


0.69333 


0.59742 


0.08610 


0.00895 


0.000794 


0.000065 


5 


0.76613 


0.70254 


0.06014 


0.00329 


0.000149 


0.000006 


6 


0.81633 


0.77665 


0.03856 


0.00109 


0.000025 


0.000001 


M J 




JH(1) 


JH{2) 


JH{3) 



100 1 
2 



0.495 

0.6665346534 



0.49005 
0.66640266 



0.0049005 
0.00013197373 



0.000049005 



That is for M = 1 we have J = | - i + ^ and JH{h) = q-^+^ ■ 



and for M = 2 wc obtain by cvahiating for several q: J 
that for g — > cxD and any M, we have J — 



. Observe 



M+l 



, according to model Lb). 



Open Problems: 

1. Show algebraically that Vsi, ss G Qt we have ^lllil = q-K{si)+K{s2) ^ ^^lere 

pr[s2) 

K{s) is defined via the number of inhibitions from (0, . . . , 0; 0). 

2. Show algebraically that \{s e Qt \ K{s) = K} = pk{M) for all K,T,M. 

3. Give a closed form for the coefficients of all the new formal power series 
in occuring in this paper. 



Conclusion 



We developed a model of multidimensional linear and jump complexity, using 
a stochastic infinite state machine, which is selfsimilar on the time axis, 
folding back time mod M+l onto itself. 

Fixing an arbitrary good accuracy level Kq, we obtain a finite model that ap- 
proximates with an exponentially small (in Kq) error, using only polynomially 
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many states. 



We derived values for linear and jump complexity of multisequences in the 
average case and probabilities for deviations from that case. 

The whole theory is valid for any q (order of finite field), any M (number 
of sequences) and any timestep n, We have numerical results for M up to 8, 
n — > oo, and any q, extending considerably the range of known results. 
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Appendix State counts for M = 3, T = 0, K — 0,1, ... ,50 (vertical) and 
d = —10, —9,..., 9 (horizontal), d — within dots. The last column is 
Pk{M). 
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